@starci/hfs 4.9.9 → 4.10.0

package/runtime/scripts/hfs/rule-params-shape.mjs

@@ -62,6 +62,9 @@ function beSpecificProblems(be, manifest) {
   return bad;
 }
 
+/** True for an absent list or a list of {name, reason} database functions, names unique. */
+export const dbFunctionsOk = (list) => list === undefined || (Array.isArray(list) && list.every((entry) => isPlainObject(entry) && Object.keys(entry).sort().join() === 'name,reason' && /^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)?$/.test(entry.name) && typeof entry.reason === 'string' && entry.reason.trim().length > 0) && new Set(list.map((entry) => entry.name)).size === list.length);
+
 /** The shape problems of `m.ruleParams`. */
 export function ruleParamsProblems(m) {
   const bad = [];
@@ -71,7 +74,7 @@ export function ruleParamsProblems(m) {
     // common holds the parameters both sides share; a side may restate one of them (a valid value) as an override, nothing else.
     // Edition lite: a side's optional `lite` map overrides keys of the same side (never `lite` itself) when the app declares edition lite.
     if (!sideOk(rp.common, []) || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}; optional functionLines and featureFiles must be positive integers');
-    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
+    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite', 'dbFunctions']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !dbFunctionsOk(rp.be.dbFunctions) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority', 'dbFunctions'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + '), dbFunctions ([{name, reason}]) and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
     bad.push(...beSpecificProblems(rp.be, m));
     if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, SHARED_KEYS))) bad.push('ruleParams.fe may only restate the shared parameters of ruleParams.common, and carry a lite override of them');
     if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions (a list of unique non-empty extension names) and queueOutbox ({table: <schema>.<table>, columns: [unique column names including queue]})');

package/runtime/scripts/hfs/rules/a15-findings.mjs

@@ -48,7 +48,7 @@ export const A15_CODES = [
   'HFS_WORKFLOW_CONTEXT',
   'CI_STANDARD',
   'CI_SECRET_SEALED', 'APP_SECRET_IN_CI', 'CI_DECLARATION_DRIFT',
-  'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_API_EXPOSED', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_CRON_OWNED', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_SERVICE_ROLE_SCOPE', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_REDIS_PERSISTENCE', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
+  'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BOOT_PROOF_TIMEOUT', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_CRON_OWNED', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_REDIS_PERSISTENCE', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
   // codes-end
 ];
 

package/runtime/scripts/hfs/rules/cli.mjs

@@ -26,7 +26,7 @@ export function cliFindings({ files, repo, resolver }) {
   const commandFiles = onBe.filter((file) => beResolver.classifyPath(file).slot === CLI_FEATURE_SLOT);
   const findings = [];
   const cliApps = be.apps.filter((app) => app.kind === CLI_KIND);
-  // Where the cli app is only optional (litePresence: schema migration is the Supabase CLI's job) a connection no longer forces it; a tracked command still does.
+  // Where the cli app is only optional (litePresence: schema migration is `starci app db migrate`'s job) a connection no longer forces it; a tracked command still does.
   const migrates = (be.connections ?? []).length > 0 && beResolver.slot(CLI_APP_SLOT)?.presence !== 'optional';
   const needs = migrates || commandFiles.length > 0;
   let why = 'it tracks commands under be/src/features/cli/';

package/runtime/scripts/hfs/rules/database-access.mjs

@@ -1,10 +1,8 @@
-// R254-R256 inspect the final database access state, so later revokes and policy drops retire old browser doors.
+// R255-R256 inspect the final database access state: the application role, forced RLS, policies, views and storage prefixes.
 import { found } from './read.mjs';
 import { parseSql } from '../sql/pg-parse.mjs';
 import { eachInOrder } from '../../lib/in-order.mjs';
 
-export const DB_BE_ONLY_ACCESS = 'DB_BE_ONLY_ACCESS';
-export const DB_REALTIME_UNLISTED = 'DB_REALTIME_UNLISTED';
 export const DB_APP_ROLE = 'DB_APP_ROLE';
 export const DB_FORCE_RLS_DEFAULT = 'DB_FORCE_RLS_DEFAULT';
 export const DB_POLICY_TAUTOLOGY = 'DB_POLICY_TAUTOLOGY';
@@ -20,8 +18,6 @@ const unwrap = (node) => node?.TypeCast ? unwrap(node.TypeCast.arg) : node;
 const stringValue = (node) => unwrap(node)?.A_Const?.sval?.sval;
 const operator = (node) => names(node.name);
 const publicRead = (policy) => policy.cmd === 'select' && policy.name.endsWith('_public_read');
-const anonymous = (role) => role === 'anon' || role === 'public';
-const browserRole = (role) => anonymous(role) || role === 'authenticated';
 const AND = ['AND', 'EXPR'].join('_');
 const OR = ['OR', 'EXPR'].join('_');
 const NOT = ['NOT', 'EXPR'].join('_');
@@ -119,40 +115,10 @@ function updatePrivileges(state, granting, privileges) {
   if (privileges.some((privilege) => ['select', 'all'].includes(privilege))) state.revokedRead = true;
 }
 
-function grantAccessFindings(grants, policies, exposed, directAccess) {
-  const findings = [];
-  for (const state of grants.values()) {
-    if (!state.privileges.size || !browserRole(state.role)) continue;
-    if (!exposed.has(state.target.split('.')[0]) || directAccess.has(state.target)) continue;
-    const readOnly = state.privileges.size === 1 && state.privileges.has('select');
-    const policy = policies.some((item) => `${item.schema}.${item.table}` === state.target && publicRead(item)
-      && item.roles.some((role) => role === state.role || role === 'public'));
-    if (anonymous(state.role) && state.objtype === 'OBJECT_TABLE' && readOnly && policy) continue;
-    findings.push(note(DB_BE_ONLY_ACCESS, state, `grants ${state.role} data privileges on ${state.target}; browser data access requires supabase.directAccess, or anonymous SELECT beside *_public_read`, { table: state.target }));
-  }
-  return findings;
-}
-
-function defaultAccessFindings(analyses, exposed) {
-  const findings = [];
-  for (const { file, facts } of analyses) {
-    for (const defaults of facts.defaultPrivileges) {
-      if (!defaults.grant || !['OBJECT_TABLE', SEQUENCE].includes(defaults.objtype)) continue;
-      if (defaults.schemas?.length && !defaults.schemas.some((schema) => exposed.has(schema))) continue;
-      if (defaults.grantees.some(browserRole)) findings.push(note(DB_BE_ONLY_ACCESS, { ...defaults, file }, 'grants default browser data privileges; exposed data grants must be explicit per table'));
-    }
-  }
-  return findings;
-}
-
-function policyFindings(policies, exposed, directAccess, appRole, helpers) {
+function policyFindings(policies, appRole, helpers) {
   const findings = [];
   for (const policy of policies) {
     const table = `${policy.schema}.${policy.table}`;
-    const listed = directAccess.has(table);
-    if (exposed.has(policy.schema) && !listed && policy.roles.some((role) => browserRole(role) && !(anonymous(role) && publicRead(policy)))) {
-      findings.push(note(DB_BE_ONLY_ACCESS, policy, `policy ${policy.name} opens ${table} to browser roles; list intentional access in supabase.directAccess`, { table, policy: policy.name }));
-    }
     if (policy.roles.every((role) => role === appRole) || publicRead(policy)) continue;
     const predicates = [policy.qual, policy.withCheck].filter((expression) => expression !== undefined);
     if (!predicates.length || predicates.some((expression) => !principalPredicate(expression, helpers))) {
@@ -187,34 +153,6 @@ function roleStatementFindings(statement, appRole) {
   return [note(DB_APP_ROLE, statement, `${appRole} must LOGIN NOINHERIT without SUPERUSER, BYPASSRLS or administrative role attributes`)];
 }
 
-function publicationTargets(node, defaultSchema) {
-  if (node.for_all_tables) return ['*'];
-  return (node.pubobjects ?? []).map(({ PublicationObjSpec: spec }) => {
-    if (spec.pubtable?.relation) return relationName(spec.pubtable.relation, defaultSchema);
-    return `${spec.name ?? defaultSchema}.*`;
-  });
-}
-
-function publicationFindings(analyses, directAccess) {
-  const tables = new Map();
-  for (const { file, facts } of analyses) {
-    for (const statement of facts.statements) {
-      applyPublication(tables, { ...statement, file });
-    }
-  }
-  return [...tables].filter(([table]) => !directAccess.has(table)).map(([table, source]) => note(DB_REALTIME_UNLISTED, source, `supabase_realtime publishes unlisted ${table}; every browser data table must be in supabase.directAccess`, { table }));
-}
-
-function applyPublication(tables, statement) {
-  const { type, node, defaultSchema } = statement;
-  if (!['CreatePublicationStmt', 'AlterPublicationStmt'].includes(type) || node.pubname !== 'supabase_realtime') return;
-  if (type === 'CreatePublicationStmt' || node.action === 'AP_SetObjects') tables.clear();
-  for (const table of publicationTargets(node, defaultSchema)) {
-    if (node.action === 'AP_DropObjects') tables.delete(table);
-    else tables.set(table, statement);
-  }
-}
-
 function tableStates(analyses) {
   const tables = new Map();
   let owner = null;
@@ -251,10 +189,10 @@ function applyTableAlter(tables, statement) {
   tables.set(key, table);
 }
 
-function forceFindings(analyses, supabase, appRole) {
-  const exemptions = new Set((supabase.forceRlsExemptions ?? []).filter((item) => typeof item?.table === 'string' && typeof item.reason === 'string' && item.reason.trim()).map((item) => qualify(item.table)));
+function forceFindings(analyses, db, appRole) {
+  const exemptions = new Set((db.forceRlsExemptions ?? []).filter((item) => typeof item?.table === 'string' && typeof item.reason === 'string' && item.reason.trim()).map((item) => qualify(item.table)));
   return [...tableStates(analyses)].filter(([name, table]) => table.owner === appRole && !table.forced && !exemptions.has(name))
-    .map(([table, source]) => note(DB_FORCE_RLS_DEFAULT, source, `${appRole} owns ${table} without FORCE ROW LEVEL SECURITY; an exemption needs supabase.forceRlsExemptions with a table and reason`, { table }));
+    .map(([table, source]) => note(DB_FORCE_RLS_DEFAULT, source, `${appRole} owns ${table} without FORCE ROW LEVEL SECURITY; an exemption needs hfs.json db.forceRlsExemptions with a table and reason`, { table }));
 }
 
 function viewFindings(analyses, grants, exposed) {
@@ -318,10 +256,9 @@ function storagePrefixFindings(policies, helpers) {
 }
 
 /** All new access checks run on the ordered active migrations in either edition, through checkDatabase. */
-export async function databaseAccessFindings({ analyses, exposed, supabase = {} }) {
-  const declared = supabase ?? {};
+export async function databaseAccessFindings({ analyses, exposed, db = {} }) {
+  const declared = db ?? {};
   const appRole = declared.appRole ?? 'app_be';
-  const directAccess = new Set((declared.directAccess ?? []).filter((table) => typeof table === 'string').map(qualify));
   const policyMap = new Map();
   const grants = new Map();
   for (const { file, facts } of analyses) {
@@ -331,10 +268,7 @@ export async function databaseAccessFindings({ analyses, exposed, supabase = {}
   const policies = [...policyMap.values()];
   const helpers = await principalHelpers(analyses);
   return [
-    ...grantAccessFindings(grants, policies, exposed, directAccess),
-    ...defaultAccessFindings(analyses, exposed),
-    ...policyFindings(policies, exposed, directAccess, appRole, helpers),
-    ...publicationFindings(analyses, directAccess),
+    ...policyFindings(policies, appRole, helpers),
     ...roleFindings(analyses, appRole),
     ...forceFindings(analyses, declared, appRole),
     ...viewFindings(analyses, grants, exposed),

package/runtime/scripts/hfs/rules/database-baseline.mjs

@@ -8,8 +8,8 @@ import { found, readText } from './read.mjs';
 import { migrationStamp } from './database-migrations.mjs';
 import { DB_BASELINE_SHAPE, DB_ARCHIVE_MUTATED, MIGRATIONS_DIR, MIGRATIONS_ARCHIVE_DIR } from './database-constants.mjs';
 
-const ACTIVE = /^supabase\/migrations\/\d{14}_[^/]+\.sql$/;
-const ARCHIVED = /^supabase\/migrations\/_archive\/\d{14}_[^/]+\.sql$/;
+const ACTIVE = /^db\/migrations\/\d{14}_[^/]+\.sql$/;
+const ARCHIVED = /^db\/migrations\/archive\/\d{14}_[^/]+\.sql$/;
 const stampOf = (file) => /(?:^|\/)(\d{14})_/.exec(file)?.[1] ?? null;
 
 /** Header comments only: SQL literals and later comments cannot impersonate a baseline marker. */
@@ -68,7 +68,7 @@ function shapeFindings(repoRoot, active, archived) {
   if (!archived.length) return { findings: [], marked };
   const findings = [];
   if (marked.length !== 1) {
-    findings.push(found(DB_BASELINE_SHAPE, MIGRATIONS_DIR, 'a nonempty _archive requires exactly one active -- starci:baseline <archived-last-stamp> header marker'));
+    findings.push(found(DB_BASELINE_SHAPE, MIGRATIONS_DIR, 'a nonempty archive requires exactly one active -- starci:baseline <archived-last-stamp> header marker'));
     return { findings, marked };
   }
   const latest = archived.map(stampOf).filter((stamp) => stamp && migrationStamp(stamp) !== null).sort((left, right) => left.localeCompare(right)).at(-1);

package/runtime/scripts/hfs/rules/database-config.mjs

@@ -1,141 +1,13 @@
-// database-config.mjs - L08 Supabase TOML policy and L09 generated-type drift checks. Parsing and type emission stay
-// lazy/injected so applications without Supabase do not load either tool and this rule starts no Docker process.
-import { sameText } from '../../lib/same-text.mjs';
-import path from 'node:path';
-import { parse as parseTomlSync } from 'smol-toml';
-import { found, readJson, readText } from './read.mjs';
+// database-config.mjs - the database content checks of db/ (R259: extensions, custody SQL, destructive migrations, seed data). It starts no
+// database and no Docker process.
+import { found, readText } from './read.mjs';
 import {
-  CONFIG_FILE, DB_API_EXPOSED, DB_CONFIG_POLICY, DB_EXTENSION_ALLOWED, DB_TYPES_DRIFT, DB_VAULT_WRITE,
-  HFS_SEED_PII, isActiveMigration, TYPES_FILE,
+  DB_EXTENSION_ALLOWED, DB_VAULT_WRITE, HFS_SEED_PII, isActiveMigration, SEED_FILE,
 } from './database-constants.mjs';
 import { databaseExecutableTokens, databaseSqlStatements, databaseSqlTokens, destructiveMigrationFindings } from './database-migrations.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
-const ENV_REF = /^env\([A-Za-z_]\w*\)$/;
-const PUBLIC_KEYS = new Set(['anon_key', 'publishable_key', 'public_key']);
-
-
-function tomlEntries(value, path = []) {
-  if (!value || typeof value !== 'object') return [];
-  if (Array.isArray(value)) return value.flatMap((item) => tomlEntries(item, path));
-  return Object.entries(value).flatMap(([key, child]) => {
-    const at = [...path, key];
-    if (child && typeof child === 'object') {
-      if (Array.isArray(child)) {
-        if (child.every((item) => item && typeof item === 'object' && !Array.isArray(item))) return child.flatMap((item) => tomlEntries(item, at));
-      } else return tomlEntries(child, at);
-    }
-    return [[at.join('.'), key, child]];
-  });
-}
-
-const isCredentialKey = (key) => {
-  const leaf = key.toLowerCase();
-  return ['secret', 'client_id', 'key', 'pass', 'password', 'token'].includes(leaf)
-    || /_(secret|password|token|client_id|api_key)$/.test(leaf)
-    || (leaf.endsWith('_key') && !PUBLIC_KEYS.has(leaf));
-};
-
-const escapeRegexPart = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
-
-const tomlLine = (text, key) => {
-  const expression = new RegExp(String.raw`^\s*["']?${escapeRegexPart(key)}["']?\s*=`, 'm');
-  const match = expression.exec(text);
-  return match ? text.slice(0, match.index).split('\n').length : undefined;
-};
-
-function credentialConfigFindings(file, text, toml) {
-  const findings = [];
-  for (const [at, key, value] of tomlEntries(toml)) {
-    if (!isCredentialKey(key)) continue;
-    const line = tomlLine(text, key);
-    if (typeof value !== 'string' || !ENV_REF.test(value)) {
-      const lineNote = line ? `:${line}` : '';
-      findings.push(found(DB_CONFIG_POLICY, file, `${file}${lineNote} ${at} holds a literal credential; a secret in config.toml is written env(NAME), never a value`, { ...(line ? { line } : {}), key: at }));
-    }
-  }
-  return findings;
-}
-
-// A finding for an auth setting of config.toml that differs from what hfs.json supabase.<field> declares; `shown` is the setting as read.
-const settingFinding = (file, key, field, shown, declaredValue, note = '') => found(DB_CONFIG_POLICY, file, `${file} ${key} is ${shown}; hfs.json supabase.${field} declares ${declaredValue}${note}`, { key, declared: declaredValue });
-
-const shownSetting = (value) => JSON.stringify(value ?? 'absent');
-
-function signupFindings(file, auth, declared) {
-  const findings = [];
-  if (declared.enableSignup === undefined) return findings;
-  if (auth.enable_signup !== declared.enableSignup) findings.push(settingFinding(file, 'auth.enable_signup', 'enableSignup', shownSetting(auth.enable_signup), declared.enableSignup, ' - the invite posture is a checked fact, not a doc claim'));
-  if (auth.email?.enable_signup !== undefined && auth.email.enable_signup !== declared.enableSignup) {
-    findings.push(settingFinding(file, 'auth.email.enable_signup', 'enableSignup', JSON.stringify(auth.email.enable_signup), declared.enableSignup));
-  }
-  return findings;
-}
-
-function redirectUrlFindings(file, auth, declared) {
-  const findings = [];
-  if (declared.redirectUrls === undefined) return findings;
-  const configured = Array.isArray(auth.additional_redirect_urls) ? auth.additional_redirect_urls : [];
-  for (const url of configured) {
-    if (!declared.redirectUrls.includes(url)) findings.push(found(DB_CONFIG_POLICY, file, `${file} auth.additional_redirect_urls holds ${url}, which hfs.json supabase.redirectUrls does not declare; the config states nothing the app did not declare`, { key: 'auth.additional_redirect_urls', url }));
-  }
-  for (const url of declared.redirectUrls) {
-    if (!configured.includes(url)) findings.push(found(DB_CONFIG_POLICY, file, `${file} auth.additional_redirect_urls omits ${url}, which hfs.json supabase.redirectUrls declares; the config and declaration must carry the same redirect set`, { key: 'auth.additional_redirect_urls', url }));
-  }
-  return findings;
-}
-
-function declarationConfigFindings(file, auth, declared) {
-  const findings = [];
-  if (declared.jwtExpiry !== undefined && auth.jwt_expiry !== declared.jwtExpiry) findings.push(settingFinding(file, 'auth.jwt_expiry', 'jwtExpiry', shownSetting(auth.jwt_expiry), declared.jwtExpiry));
-  findings.push(...signupFindings(file, auth, declared));
-  if (declared.siteUrl !== undefined && auth.site_url !== declared.siteUrl) findings.push(settingFinding(file, 'auth.site_url', 'siteUrl', shownSetting(auth.site_url), declared.siteUrl));
-  findings.push(...redirectUrlFindings(file, auth, declared));
-  return findings;
-}
-
-/** The parsed TOML of `text`, or null when it does not parse. */
-export async function parseToml(text) {
-  try {
-    const module = await import('smol-toml');
-    return module.parse(text);
-  } catch {
-    return null;
-  }
-}
-
-/** L08 policy findings in one already-parsed supabase/config.toml. */
-export function configFindings({ file, text, toml, supabase }) {
-  const findings = credentialConfigFindings(file, text, toml);
-  const auth = toml?.auth ?? {};
-  if (auth.jwt_expiry !== undefined && (typeof auth.jwt_expiry !== 'number' || auth.jwt_expiry > 3600)) {
-    findings.push(found(DB_CONFIG_POLICY, file, `${file} auth.jwt_expiry is ${JSON.stringify(auth.jwt_expiry)}; the access token lives at most 3600 seconds`, { key: 'auth.jwt_expiry' }));
-  }
-  if (!supabase) return findings;
-  const declared = {
-    enableSignup: supabase.enableSignup, jwtExpiry: supabase.jwtExpiry, siteUrl: supabase.siteUrl,
-    redirectUrls: Array.isArray(supabase.redirectUrls) ? supabase.redirectUrls : undefined,
-  };
-  findings.push(...declarationConfigFindings(file, auth, declared));
-  return findings;
-}
-
-/** L09 drift findings for the committed generated database type file. */
-export async function typesFindings({ repoRoot, files, emitTypes, declaration }) {
-  if (typeof emitTypes !== 'function') return [];
-  const tracked = new Set(files);
-  let emitted;
-  try { emitted = await emitTypes({ repoRoot, declaration }); } catch (error) {
-    return [found(DB_TYPES_DRIFT, TYPES_FILE, `${TYPES_FILE} cannot be verified: the types emit failed (${String(error?.message ?? error).split('\n').filter(Boolean).slice(0, 3).join(' | ')})`, { drift: 'emit-failed' })];
-  }
-  const committed = tracked.has(TYPES_FILE) ? readText(repoRoot, TYPES_FILE) : null;
-  if (committed === null) return [found(DB_TYPES_DRIFT, TYPES_FILE, `${TYPES_FILE} is not committed; run \`npm run contract:emit\` and commit the generated types`, { drift: 'not-committed' })];
-  if (!sameText(committed, String(emitted))) return [found(DB_TYPES_DRIFT, TYPES_FILE, `${TYPES_FILE} differs from what \`contract:emit\` generates from the migrations now; run \`npm run contract:emit\` and commit the result`, { drift: 'stale' })];
-  return [];
-}
 
 const DEFAULT_EXTENSIONS = ['pgmq', 'pg_cron', 'pgcrypto', 'pg_trgm', 'vector', 'uuid-ossp', 'pg_net', 'supabase_vault', 'unaccent'];
-const DEFAULT_API_SCHEMAS = ['public', 'graphql_public'];
-const FORBIDDEN_API_SCHEMAS = new Set(['pgmq', 'pgmq_public']);
 const word = (token, value) => token?.t === 'word' && token.v === value;
 const identifier = (token) => token && ['word', 'ident'].includes(token.t) ? token.v : null;
 
@@ -143,8 +15,6 @@ function dbParameters(manifest) {
   const declared = manifest?.ruleParams?.db ?? {};
   return {
     extensions: Array.isArray(declared.extensions) ? declared.extensions : DEFAULT_EXTENSIONS,
-    apiSchemas: Array.isArray(declared.apiSchemas) ? declared.apiSchemas : DEFAULT_API_SCHEMAS,
-    majorVersion: declared.majorVersion ?? 17,
   };
 }
 
@@ -257,76 +127,6 @@ function applyPublicReadPolicy(statement, policies) {
   policies.set(key, { name, schema: target.schema, select: word(statement[forAt + 1], 'select'), roles: roles ?? ['public'] });
 }
 
-function publicReadSchemas(sources) {
-  const policies = new Map();
-  for (const { tokens } of sources) for (const statement of databaseSqlStatements(tokens)) applyPublicReadPolicy(statement, policies);
-  return new Set([...policies.values()].filter((policy) => policy.select && policy.name.endsWith('_public_read')
-    && policy.roles.some((role) => ['anon', 'public'].includes(role))).map((policy) => policy.schema));
-}
-
-function schemaConfigFindings(file, config, parameters, edition, publicSchemas) {
-  const schemas = config.api?.schemas;
-  const findings = [];
-  const allowed = new Set(parameters.apiSchemas);
-  if (!Array.isArray(schemas) || schemas.some((schema) => typeof schema !== 'string' || !allowed.has(schema))) {
-    findings.push(found(DB_CONFIG_POLICY, file, `${file} api.schemas must be an array drawn from ruleParams.db.apiSchemas`, { key: 'api.schemas' }));
-  }
-  if (Array.isArray(schemas) && schemas.some((schema) => FORBIDDEN_API_SCHEMAS.has(schema))) findings.push(found(DB_API_EXPOSED, file,
-    `${file} api.schemas exposes a pgmq schema; queues are accessible only to the application role`, { key: 'api.schemas' }));
-  const exposed = Array.isArray(schemas) ? schemas : DEFAULT_API_SCHEMAS;
-  if (edition === 'lite' && config.api?.enabled !== false && exposed.length > 0 && !exposed.some((schema) => publicSchemas.has(schema))) {
-    findings.push(found(DB_API_EXPOSED, file, `${file} enables the lite data API without an exposed *_public_read FOR SELECT policy; disable api or set schemas = []`, { key: 'api.enabled' }));
-  }
-  return findings;
-}
-
-function safetyConfigFindings(file, config, parameters, supabase) {
-  const findings = [];
-  const anonymous = config.auth?.enable_anonymous_sign_ins;
-  if (anonymous !== undefined && (typeof anonymous !== 'boolean' || (anonymous && supabase?.enableAnonymousSignIns !== true))) findings.push(found(DB_CONFIG_POLICY, file,
-    `${file} auth.enable_anonymous_sign_ins is enabled without hfs.json supabase.enableAnonymousSignIns`, { key: 'auth.enable_anonymous_sign_ins' }));
-  if (config.edge_runtime?.enabled !== false) findings.push(found(DB_CONFIG_POLICY, file,
-    `${file} edge_runtime.enabled must be false; application execution belongs to the back end`, { key: 'edge_runtime.enabled' }));
-  const storageLimit = config.storage?.file_size_limit;
-  if (config.storage?.enabled !== false && (typeof storageLimit !== 'string' || !/^[1-9]\d*(?:B|KB|MB|GB|KiB|MiB|GiB)$/.test(storageLimit))) findings.push(found(DB_CONFIG_POLICY, file,
-    `${file} storage.file_size_limit must declare a positive byte limit`, { key: 'storage.file_size_limit' }));
-  if (config.db?.major_version !== parameters.majorVersion) findings.push(found(DB_CONFIG_POLICY, file,
-    `${file} db.major_version must equal the ruleParams.db.majorVersion pin (${parameters.majorVersion})`, { key: 'db.major_version' }));
-  return findings;
-}
-
-function seedPattern(value) {
-  if (typeof value !== 'string' || !value || value.includes('\\') || path.posix.isAbsolute(value) || /^[A-Za-z]:/.test(value)) return null;
-  const relative = path.posix.normalize(`supabase/${value}`);
-  if (!relative.startsWith('supabase/')) return null;
-  const expression = relative.split(/(\*\*|\*|\?)/).map((part) => {
-    if (part === '**') return '.*';
-    if (part === '*') return '[^/]*';
-    if (part === '?') return '[^/]';
-    return escapeRegexPart(part);
-  }).join('');
-  return new RegExp(`^${expression}$`);
-}
-
-function seedConfigResult(repoRoot, files, config) {
-  const seeds = new Set(files.filter((file) => /^(?:supabase\/(?:seed\.sql|seeds?\/.+\.sql)|\.starcistacks\/[^/]+\/seeds\/.+\.sql)$/.test(file)));
-  const seed = config?.db?.seed;
-  if (!seed || seed.enabled === false) return { findings: [], seeds };
-  const paths = seed.sql_paths ?? ['./seed.sql'];
-  const findings = [];
-  if (!Array.isArray(paths) || paths.length === 0) return {
-    seeds, findings: [found(DB_CONFIG_POLICY, CONFIG_FILE, `${CONFIG_FILE} db.seed.sql_paths must list tracked SQL seed files`, { key: 'db.seed.sql_paths' })],
-  };
-  for (const value of paths) {
-    const pattern = seedPattern(value);
-    const matches = pattern ? files.filter((file) => file.endsWith('.sql') && pattern.test(file) && readText(repoRoot, file) !== null) : [];
-    if (matches.length === 0) findings.push(found(DB_CONFIG_POLICY, CONFIG_FILE,
-      `${CONFIG_FILE} db.seed.sql_paths contains a path with no readable tracked SQL seed file`, { key: 'db.seed.sql_paths' }));
-    for (const file of matches) seeds.add(file);
-  }
-  return { findings, seeds };
-}
-
 const EMAIL_LITERAL = /^[A-Z0-9._%+-]+@([A-Z0-9-]+(?:\.[A-Z0-9-]+)+)$/i;
 function piiLiteral(value) {
   if (value.split(/[^\w.%+@-]+/).some((part) => {
@@ -356,20 +156,12 @@ function seedPiiFindings(repoRoot, seeds) {
 export function databaseConfigFindings({ repoRoot, files = [], all = files, repo = {}, manifest, isRoot, inScope = () => true }) {
   if (isRoot === false || ['be', 'fe'].includes(repo.profile)) return [];
   const parameters = dbParameters(manifest);
-  const declaration = readJson(repoRoot, 'hfs.json');
-  const edition = repo.edition ?? declaration?.edition ?? 'full';
   const migrations = all.filter((file) => isActiveMigration(file) && file.endsWith('.sql')).sort(byCodeUnit);
   const sources = migrations.map((file) => ({ file, tokens: databaseExecutableTokens(readText(repoRoot, file) ?? '') }));
   const findings = [];
   for (const { file, tokens } of sources) findings.push(...extensionFindings(file, tokens, new Set(parameters.extensions)), ...custodySqlFindings(file, tokens));
   findings.push(...destructiveMigrationFindings({ repoRoot, migrations, files: all }));
-  let config = null;
-  if (all.includes(CONFIG_FILE)) {
-    try { const text = readText(repoRoot, CONFIG_FILE); if (text !== null) config = parseTomlSync(text); } catch { /* L08 owns invalid TOML. */ }
-  }
-  if (config) findings.push(...schemaConfigFindings(CONFIG_FILE, config, parameters, edition, publicReadSchemas(sources)),
-    ...safetyConfigFindings(CONFIG_FILE, config, parameters, declaration?.supabase));
-  const seeds = seedConfigResult(repoRoot, all, config);
-  findings.push(...seeds.findings, ...seedPiiFindings(repoRoot, seeds.seeds));
+  const seeds = all.filter((file) => file === SEED_FILE || /^\.starcistacks\/[^/]+\/seeds\/.+\.sql$/.test(file));
+  findings.push(...seedPiiFindings(repoRoot, seeds));
   return findings.filter((finding) => inScope(finding.path));
 }

package/runtime/scripts/hfs/rules/database-constants.mjs

@@ -1,26 +1,24 @@
-// Single source of database-rule finding codes and owned Supabase paths.
+// Single source of database-rule finding codes and the owned db/ paths of a lite app (slot app.db).
 export const DB_MIGRATION_SHAPE = 'DB_MIGRATION_SHAPE';
 export const DB_RLS_REQUIRED = 'DB_RLS_REQUIRED';
 export const DB_DYNAMIC_DDL = 'DB_DYNAMIC_DDL';
 export const DB_POLICY_SHAPE = 'DB_POLICY_SHAPE';
 export const DB_DEFINER_SAFE = 'DB_DEFINER_SAFE';
 export const DB_STORAGE_POLICY = 'DB_STORAGE_POLICY';
-export const DB_CONFIG_POLICY = 'DB_CONFIG_POLICY';
-export const DB_TYPES_DRIFT = 'DB_TYPES_DRIFT';
+export const LITE_DB_MIGRATION = 'LITE_DB_MIGRATION';
 export const DB_BASELINE_SHAPE = 'DB_BASELINE_SHAPE';
 export const DB_ARCHIVE_MUTATED = 'DB_ARCHIVE_MUTATED';
 export const DB_PGMQ_DECLARED = 'DB_PGMQ_DECLARED';
 export const DB_CRON_OWNED = 'DB_CRON_OWNED';
 export const DB_EXTENSION_ALLOWED = 'DB_EXTENSION_ALLOWED';
-export const DB_API_EXPOSED = 'DB_API_EXPOSED';
 export const DB_MIGRATION_DESTRUCTIVE = 'DB_MIGRATION_DESTRUCTIVE';
 export const HFS_SEED_PII = 'HFS_SEED_PII';
 export const DB_VAULT_WRITE = 'DB_VAULT_WRITE';
 
-export const MIGRATIONS_DIR = 'supabase/migrations';
-/** The migrations retired at a baseline cutover (slot app.supabase.migrations.archive): never applied, never judged by L02-L08. */
-export const MIGRATIONS_ARCHIVE_DIR = `${MIGRATIONS_DIR}/_archive`;
-/** True for a migration the Supabase CLI applies: a path under supabase/migrations/ outside the archive. */
+export const DB_DIR = 'db';
+export const MIGRATIONS_DIR = `${DB_DIR}/migrations`;
+/** The migrations retired at a baseline cutover (slot app.db.migrations.archive): never applied, never judged by L02-L08. */
+export const MIGRATIONS_ARCHIVE_DIR = `${MIGRATIONS_DIR}/archive`;
+/** True for a migration `starci app db migrate` applies: a path under db/migrations/ outside the archive. */
 export const isActiveMigration = (file) => file.startsWith(`${MIGRATIONS_DIR}/`) && !file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`);
-export const CONFIG_FILE = 'supabase/config.toml';
-export const TYPES_FILE = 'supabase/types/database.types.ts';
+export const SEED_FILE = `${DB_DIR}/seed.sql`;

package/runtime/scripts/hfs/rules/database-migrations.mjs

@@ -74,7 +74,7 @@ function localMigrationFindings(local) {
   const stamps = new Map();
   for (const entry of local) {
     if (!entry.match) {
-      findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} is not named <ts14>_<kebab>.sql; a migration is created by \`npm run db:new\` (supabase migration new), never renamed by hand`, { expected: '<ts14>_<kebab>.sql' }));
+      findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} is not named <ts14>_<kebab>.sql; a migration is created by \`npm run db:new\` (starci app db new), never renamed by hand`, { expected: '<ts14>_<kebab>.sql' }));
       continue;
     }
     const stamp = migrationStamp(entry.match[1]);
@@ -143,8 +143,8 @@ function removedMigrationFindings(local, retired, baseNames, baseSha) {
 }
 
 /**
- * L02 findings for names, stamps, ordering and immutability of supabase/migrations/*.sql. `archived` are the files of
- * supabase/migrations/_archive/ (app.supabase.migrations.archive): never judged, and a migration moved there at a baseline
+ * L02 findings for names, stamps, ordering and immutability of db/migrations/*.sql. `archived` are the files of
+ * db/migrations/archive/ (app.db.migrations.archive): never judged, and a migration moved there at a baseline
  * cutover is retired from the ordering chain, not removed. New files append after HEAD's active migrations; timestamps
  * on archived migrations, remote branches and the wall clock do not constrain a replacement baseline.
  */

package/runtime/scripts/hfs/rules/database-queues.mjs

@@ -172,7 +172,7 @@ function migrationStatement(state, node, file) {
 }
 
 function migrationFacts(state, files) {
-  for (const file of files.filter((item) => item.endsWith('.sql') && !item.includes('/_archive/')).sort((left, right) => left.localeCompare(right))) {
+  for (const file of files.filter((item) => item.endsWith('.sql') && !item.startsWith('db/migrations/archive/')).sort((left, right) => left.localeCompare(right))) {
     const text = readText(state.repoRoot, file);
     if (text === null) continue;
     const tree = sqlTree(text);
@@ -373,9 +373,8 @@ function tickOwner(state, tick, name, schedule, ticks) {
 function queueState({ repoRoot, files = [], all = files, repo = {}, manifest }) {
   const paths = [...new Set(all)];
   const declaration = readJson(repoRoot, 'hfs.json') ?? repo;
-  const connected = ['be', 'fe'].some((side) => (declaration.sides?.[side]?.connections ?? []).some((item) => item.provider === 'supabase'));
-  if (repo.edition !== 'lite' && declaration.edition !== 'lite' && !declaration.supabase && !connected && !paths.some((file) => file.startsWith('supabase/'))) return null;
-  const state = { repoRoot, appRole: declaration.supabase?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), declaredOutbox: queueOutboxDeclaration(declaration), scheduledNames: new Set(), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
+  if (repo.edition !== 'lite' && declaration.edition !== 'lite' && !paths.some((file) => file.startsWith('db/'))) return null;
+  const state = { repoRoot, appRole: declaration.db?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), declaredOutbox: queueOutboxDeclaration(declaration), scheduledNames: new Set(), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
   state.sources = queueSourceFacts(state, paths, inspectCalls);
   migrationFacts(state, paths);
   return state;
@@ -394,7 +393,7 @@ function validateQueues(state, inScope) {
   return state.findings.filter((finding) => inScope(finding.path));
 }
 
-/** Cross-file R258 findings. A full app participates when it declares or contains Supabase files. */
+/** Cross-file R258 findings. A full app participates when it contains a db/ tree. */
 export function databaseQueuesFindings(context) {
   // The app-root pass owns the cross-file inventory; a side pass cannot see its migrations.
   if (context.appSide === true) return [];

package/runtime/scripts/hfs/rules/database-sql.mjs

@@ -283,7 +283,7 @@ function rlsFindings(file, facts, exposed, forceRls) {
       findings.push(found(DB_RLS_REQUIRED, file, `${file}:${table.line} ${operation} ${qualified} into the exposed schema ${table.schema} without a later \`alter table ${qualified} enable row level security\` in the same migration`, { line: table.line, table: qualified }));
     }
     if (forceRls.has(qualified) && !relationHasLaterEvent(facts.forces, table)) {
-      findings.push(found(DB_RLS_REQUIRED, file, `${file}:${table.line} ${operation} ${qualified}, which hfs.json supabase.forceRls declares definer-owned, without \`alter table ${qualified} force row level security\` in the same migration`, { line: table.line, table: qualified }));
+      findings.push(found(DB_RLS_REQUIRED, file, `${file}:${table.line} ${operation} ${qualified}, which hfs.json db.forceRls declares definer-owned, without \`alter table ${qualified} force row level security\` in the same migration`, { line: table.line, table: qualified }));
     }
   }
   findings.push(...rlsWeakeningFindings(file, facts.rlsEvents, exposed));